oletools icon indicating copy to clipboard operation
oletools copied to clipboard

Olevba can't parse vsdm (Visio) files anymore

Open eyaltemps opened this issue 2 years ago • 1 comments

Affected tool: olevba

Describe the bug With Olevba 0.56, I could watch and analyze the macros of vsdm files. On latest (0.60), it is impossible because of an Error: ERROR Unhandled exception in main: expected str, bytes or os.PathLike object, not NoneType

Traceback (most recent call last):
  File "olevba.py", line 4668, in main
    curr_return_code = process_file(filename, data, container, options)
  File "C:\Users\my.user\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0\LocalCache\local-packages\Python39\site-packages\oletools\olevba.py", line 4477, in process_file
    vba_parser = VBA_Parser_CLI(filename, data=data, container=container,
  File "C:\Users\my.user\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0\LocalCache\local-packages\Python39\site-packages\oletools\olevba.py", line 4029, in __init__
    super(VBA_Parser_CLI, self).__init__(*args, **kwargs)
  File "C:\Users\my.user\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0\LocalCache\local-packages\Python39\site-packages\oletools\olevba.py", line 2754, in __init__
    self.ftg = ftguess.FileTypeGuesser(self.filename, data=data)
  File "C:\Users\my.user\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0\LocalCache\local-packages\Python39\site-packages\oletools\ftguess.py", line 658, in __init__
    if FType_Generic_OpenXML.recognize(self):
  File "C:\Users\my.user\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0\LocalCache\local-packages\Python39\site-packages\oletools\ftguess.py", line 447, in recognize
    main_part_ext = os.path.splitext(main_part)[1][1:]
  File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.9_3.9.2800.0_x64__qbz5n2kfra8p0\lib\ntpath.py", line 204, in splitext
    p = os.fspath(p)
TypeError: expected str, bytes or os.PathLike object, not NoneType

File/Malware sample to reproduce the bug testfile.zip (password: Password1)

How To Reproduce the bug run olevba {FILE_PATH}/ olevba -jc {FILE_PATH}

Expected behavior Olevba analysis would work fine

Console output / Screenshots 0.60: image

0.56: image image

Thanks!

eyaltemps avatar Feb 23 '22 11:02 eyaltemps

The same error occurs (on Debian Bullseye) when I try to parse a vsdx file, e.g. for visio-sample.zip (which is a trivial document without any macros and just a single string):

$ olevba nomacro.vsdx
olevba 0.60 on Python 3.9.2 - http://decalage.info/python/oletools
ERROR    Unhandled exception in main: expected str, bytes or os.PathLike object, not NoneType
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/oletools/olevba.py", line 4668, in main
    curr_return_code = process_file(filename, data, container, options)
  File "/usr/lib/python3/dist-packages/oletools/olevba.py", line 4477, in process_file
    vba_parser = VBA_Parser_CLI(filename, data=data, container=container,
  File "/usr/lib/python3/dist-packages/oletools/olevba.py", line 4029, in __init__
    super(VBA_Parser_CLI, self).__init__(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/oletools/olevba.py", line 2754, in __init__
    self.ftg = ftguess.FileTypeGuesser(self.filename, data=data)
  File "/usr/lib/python3/dist-packages/oletools/ftguess.py", line 658, in __init__
    if FType_Generic_OpenXML.recognize(self):
  File "/usr/lib/python3/dist-packages/oletools/ftguess.py", line 447, in recognize
    main_part_ext = os.path.splitext(main_part)[1][1:]
  File "/usr/lib/python3.9/posixpath.py", line 118, in splitext
    p = os.fspath(p)
TypeError: expected str, bytes or os.PathLike object, not NoneType

albrechtd avatar Apr 04 '22 11:04 albrechtd